Steelhead Appliance

[cgeary]

Interesting. Traces on the Steelhead you do have should show you what is going on.

[geertn444]

I am investigating further into this. We don't have firewall or filtering installed between this server and the SH (or it must be the firewall on the server itself). I am seeing this message always towards the same server, a Symantec Anti-Virus server TCP 2967. A lot (if not all) of our PCs are contacting this server regularly. I think the server might be saturated and it is not accepting SYN requests sometimes from clients.When the Riverbed retries, by coincidence, maybe the third try without options succeeds...and SH thinks the other requests were filtered....

[cgeary]

https://supportkb.riverbed.com/support/index?page=content&id=S13641&actp=search&viewlocale=en_US&sea...

It is logged at warning level because it is a bad thing. Each connection setup is experiencing upwards of 6 seconds of delay while probed tcp SYNs are retried before the Steelhead gives up and passes the connection through.

[geertn444]

I am seeing this message a lot:

Feb 15 17:33:19 : [intercept.WARN] it appears as though probes from 159.114.114.39 to 10.101.82.168 are being filtered. Passing through connections between these two hosts.

I am sure it is nothing serious, but would just like to understand. Does the SH log this message if there is no response to a probe packet and the TCP session continues unoptimized ? This is indeed our case, as the remote site 10.101.82.168 does not have a SH installed.Frankly, i don't really want to log this as a warning, but more as "information"....